SUSE CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

DEBIAN-CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110353

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110353

HAProxy versions 3.2 before 3.4.6 are vulnerable to a denial of service (worker-thread CPU exhaustion) due to a flaw in the h2c_handle_ping function within src/mux_h2.c. The root cause is a failure to check for a short read during the processing of truncated HTTP/2 PING frames . This causes the H...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

EUVD-2026-108001

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CVE-2026-110353

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

PT-2026-120964

Name of the Vulnerable Software and Affected Versions HAProxy versions 3.2 through 3.4.5 Description A remote unauthenticated attacker can cause a denial of service resulting in worker-thread CPU exhaustion by sending a truncated HTTP/2 PING frame. The function h2c handle ping in src/mux h2.c fai...

Linux Distros Unpatched Vulnerability : CVE-2026-110353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker- thread CPU exhaustion via a truncated HTTP/2 PING frame...

Red Hat: CVE-2026-110353: haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...